46022 matches found
PT-2026-94422
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A signed overflow occurs in the fq pie init function when the default quantum is set using psched mtu without clamping. On devices with an exceptionally large Maximum Transmission Unit...
PT-2026-94406
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network scheduler where the qdisc get stab function accepts a user-supplied size table. The qdisc calculate pkt len function can amplify the qdisc pkt len value...
PT-2026-94423
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fq codel init function where the q-quantum and q-cparams.mtu values are set using psched mtu without proper clamping. When a device is configured with an excessive...
PT-2026-94455
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the net/smc module when the smc llc flow stop function resets a flow structure using a blind memset. If the flow-qentry variable is non-NULL, the pointer is...
PT-2026-94490
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtio net driver where the virtnet rx resize function fails to resize the rq-xsk buffs XSK buffer array when an AF XDP socket is attached. If the ring size...
PT-2026-94549
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the net: page pool component. The problem occurs due to a race condition during xa cmpxchg when page pool destroy executes page pool scrub concurrent...
PT-2026-94667
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rapidio component where rio alloc net stores a newly allocated rio net in mport-net before the device is registered. If rio add net fails, the device reference is...
PT-2026-94596
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched: cls api component where a race condition occurs during the insertion of a protocol. In the tc new tfilter function, if a request loses a race to insert ...
CVE-2026-90071: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...
CVE-2026-90248: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...
CVE-2026-90081: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...
CVE-2026-90076: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit computes quantum = 2 pschedmtu and initialquantum = 10 pschedmtu with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU...
CVE-2026-90075: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: fqcodel: clamp default quantum and mtu fqcodelinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return 0x80000000...
CVE-2026-90073: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes weight...
CVE-2026-90072: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed overflow soft lockup sfqinit sets q-quantum = pschedmtuqdiscdevsch unsigned. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return...
CVE-2026-90071: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...
CVE-2026-90063: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...
CVE-2026-90058: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...
CVE-2026-90053: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...
